Mailing List Archive

How to parameterize an action?
HI,

I am trying to parameterize an action in rsyslog.conf, but I can't seem to
get the configuration right. For example, I am trying to do something
that looks like:

$.server = "1.2.3.4";

....

action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
template="MyTemplate")


But rsyslog is complaining that the '$' an '.' are invalid characters in
the object definition.

I've been searching but cannot find the right syntax. So what IS the
right syntax to do this?

Thanks,

-derek
--
Derek Atkins 617-623-3745
derek@ihtfp.com www.ihtfp.com
Computer and Internet Security Consultant

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: How to parameterize an action? [ In reply to ]
you cannot use a variable as a target, that's not supported.

David Lang

On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:

> Date: Fri, 6 May 2022 15:49:17 -0400
> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Derek Atkins <derek@ihtfp.com>
> Subject: [rsyslog] How to parameterize an action?
>
> HI,
>
> I am trying to parameterize an action in rsyslog.conf, but I can't seem to
> get the configuration right. For example, I am trying to do something
> that looks like:
>
> $.server = "1.2.3.4";
>
> ....
>
> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
> template="MyTemplate")
>
>
> But rsyslog is complaining that the '$' an '.' are invalid characters in
> the object definition.
>
> I've been searching but cannot find the right syntax. So what IS the
> right syntax to do this?
>
> Thanks,
>
> -derek
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: How to parameterize an action? [ In reply to ]
Hi David,

On Fri, May 6, 2022 4:01 pm, David Lang wrote:
> you cannot use a variable as a target, that's not supported.

Oh well. Thank you for the rapid response.

The reason I feel I need this (perhaps there is a better way) is that I am
running rsyslogd in a container as a forwarder, so it is listening for
connections and then forwarding it on. Because it is in a container, I do
not necessarily know the upstream target prior to deployment, so I wanted
to be able to create a config file that defined the upstream target and
have the base config load that second file, read in the (dynamic) target,
and use it.

But it sounds like the approach won't work. So I'll need to figure out
another way. Any suggestions?

Thanks,

> David Lang

-derek

> On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:
>
>> Date: Fri, 6 May 2022 15:49:17 -0400
>> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
>> To: rsyslog@lists.adiscon.com
>> Cc: Derek Atkins <derek@ihtfp.com>
>> Subject: [rsyslog] How to parameterize an action?
>>
>> HI,
>>
>> I am trying to parameterize an action in rsyslog.conf, but I can't seem
>> to
>> get the configuration right. For example, I am trying to do something
>> that looks like:
>>
>> $.server = "1.2.3.4";
>>
>> ....
>>
>> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
>> template="MyTemplate")
>>
>>
>> But rsyslog is complaining that the '$' an '.' are invalid characters in
>> the object definition.
>>
>> I've been searching but cannot find the right syntax. So what IS the
>> right syntax to do this?
>>
>> Thanks,
>>
>> -derek
>>
>


--
Derek Atkins 617-623-3745
derek@ihtfp.com www.ihtfp.com
Computer and Internet Security Consultant

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: How to parameterize an action? [ In reply to ]
On Fri, 6 May 2022, Derek Atkins wrote:

> Hi David,
>
> On Fri, May 6, 2022 4:01 pm, David Lang wrote:
>> you cannot use a variable as a target, that's not supported.
>
> Oh well. Thank you for the rapid response.
>
> The reason I feel I need this (perhaps there is a better way) is that I am
> running rsyslogd in a container as a forwarder, so it is listening for
> connections and then forwarding it on. Because it is in a container, I do
> not necessarily know the upstream target prior to deployment, so I wanted
> to be able to create a config file that defined the upstream target and
> have the base config load that second file, read in the (dynamic) target,
> and use it.
>
> But it sounds like the approach won't work. So I'll need to figure out
> another way. Any suggestions?

specify a name and set the name -> IP mapping in /etc/hosts (or via DNS)

David Lang

> Thanks,
>
>> David Lang
>
> -derek
>
>> On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:
>>
>>> Date: Fri, 6 May 2022 15:49:17 -0400
>>> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
>>> To: rsyslog@lists.adiscon.com
>>> Cc: Derek Atkins <derek@ihtfp.com>
>>> Subject: [rsyslog] How to parameterize an action?
>>>
>>> HI,
>>>
>>> I am trying to parameterize an action in rsyslog.conf, but I can't seem
>>> to
>>> get the configuration right. For example, I am trying to do something
>>> that looks like:
>>>
>>> $.server = "1.2.3.4";
>>>
>>> ....
>>>
>>> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
>>> template="MyTemplate")
>>>
>>>
>>> But rsyslog is complaining that the '$' an '.' are invalid characters in
>>> the object definition.
>>>
>>> I've been searching but cannot find the right syntax. So what IS the
>>> right syntax to do this?
>>>
>>> Thanks,
>>>
>>> -derek
>>>
>>
>
>
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: How to parameterize an action? [ In reply to ]
Hi,

On Fri, May 6, 2022 4:14 pm, David Lang wrote:
>
>> But it sounds like the approach won't work. So I'll need to figure out
>> another way. Any suggestions?
>
> specify a name and set the name -> IP mapping in /etc/hosts (or via DNS)

Unfortunately that wont work. I won't know until deployment if I need to
log to logger.example.com, logger.foo.org, logger.x.y, etc. And from the
container I am pretty sure I do not have access to overwrite /etc/hosts
(and I have a feeling /etc/hosts in the container won't do anything).

It sounds like the only thing I can do is $Include the local config file
and within that file define the WHOLE action.

Definitely not ideal.

Ah well.

> David Lang

-derek

>> Thanks,
>>
>>> David Lang
>>
>> -derek
>>
>>> On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:
>>>
>>>> Date: Fri, 6 May 2022 15:49:17 -0400
>>>> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
>>>> To: rsyslog@lists.adiscon.com
>>>> Cc: Derek Atkins <derek@ihtfp.com>
>>>> Subject: [rsyslog] How to parameterize an action?
>>>>
>>>> HI,
>>>>
>>>> I am trying to parameterize an action in rsyslog.conf, but I can't
>>>> seem
>>>> to
>>>> get the configuration right. For example, I am trying to do something
>>>> that looks like:
>>>>
>>>> $.server = "1.2.3.4";
>>>>
>>>> ....
>>>>
>>>> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
>>>> template="MyTemplate")
>>>>
>>>>
>>>> But rsyslog is complaining that the '$' an '.' are invalid characters
>>>> in
>>>> the object definition.
>>>>
>>>> I've been searching but cannot find the right syntax. So what IS the
>>>> right syntax to do this?
>>>>
>>>> Thanks,
>>>>
>>>> -derek
>>>>
>>>
>>
>>
>>
>


--
Derek Atkins 617-623-3745
derek@ihtfp.com www.ihtfp.com
Computer and Internet Security Consultant

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: How to parameterize an action? [ In reply to ]
On Fri, 6 May 2022, Derek Atkins wrote:

> Hi,
>
> On Fri, May 6, 2022 4:14 pm, David Lang wrote:
>>
>>> But it sounds like the approach won't work. So I'll need to figure out
>>> another way. Any suggestions?
>>
>> specify a name and set the name -> IP mapping in /etc/hosts (or via DNS)
>
> Unfortunately that wont work. I won't know until deployment if I need to
> log to logger.example.com, logger.foo.org, logger.x.y, etc. And from the
> container I am pretty sure I do not have access to overwrite /etc/hosts
> (and I have a feeling /etc/hosts in the container won't do anything).

I expect that /etc/hosts in the container will work (you are still running
Linux, just sharing a kernel, but all the context is container specific). I know
DNS will work and you can create a new name just for the service that you then
map to the correct host

> It sounds like the only thing I can do is $Include the local config file
> and within that file define the WHOLE action.

that will work.

David Lang

> Definitely not ideal.
>
> Ah well.
>
>> David Lang
>
> -derek
>
>>> Thanks,
>>>
>>>> David Lang
>>>
>>> -derek
>>>
>>>> On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:
>>>>
>>>>> Date: Fri, 6 May 2022 15:49:17 -0400
>>>>> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
>>>>> To: rsyslog@lists.adiscon.com
>>>>> Cc: Derek Atkins <derek@ihtfp.com>
>>>>> Subject: [rsyslog] How to parameterize an action?
>>>>>
>>>>> HI,
>>>>>
>>>>> I am trying to parameterize an action in rsyslog.conf, but I can't
>>>>> seem
>>>>> to
>>>>> get the configuration right. For example, I am trying to do something
>>>>> that looks like:
>>>>>
>>>>> $.server = "1.2.3.4";
>>>>>
>>>>> ....
>>>>>
>>>>> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
>>>>> template="MyTemplate")
>>>>>
>>>>>
>>>>> But rsyslog is complaining that the '$' an '.' are invalid characters
>>>>> in
>>>>> the object definition.
>>>>>
>>>>> I've been searching but cannot find the right syntax. So what IS the
>>>>> right syntax to do this?
>>>>>
>>>>> Thanks,
>>>>>
>>>>> -derek
>>>>>
>>>>
>>>
>>>
>>>
>>
>
>
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.